Privacy Policy

We have no way to access any account you own. There is no “connect your bank” step, no aggregator, no read token, no card number. We cannot see your balance, initiate a payment, or look at anything you have not sent us.

This is the central design decision of the product, not a policy we could quietly change: the software has no code path for it.

Your email address, because it is how you sign in. If you use Google, we receive your email, name and Google account identifier.

What you tell us you own — assets, liabilities and income you enter yourself, including estimates. Nothing here is verified against any third party.

Statements you upload. We store the file and the transactions we read out of it: date, description, merchant, amount, currency and the category we assign. Statements often contain your name, account number and address; we do not extract or index those, but they remain in the stored file until you delete it.

A phone number, only if you give one, and only to send the monthly reminder to upload. It is not used to sign in.

Basic operational records — sign-in times, IP address and browser on requests, and an audit log of account changes. We keep these to investigate abuse and to be able to tell you what happened to your account.

No advertising or analytics trackers. No third-party pixels. No device fingerprinting. No location beyond the country you choose. We do not build a profile of you for anyone else’s benefit.

To turn a statement into transactions, the file is sent to Anthropic’s Claude API, which extracts the lines and suggests a category for each. Anthropic processes it to return that result and does not use API data to train their models.

This is the one place your statement content leaves our servers. If that is not acceptable to you, TharwaLens is not the right product — we would rather say so plainly than bury it.

On a server in Singapore, in a PostgreSQL database, on an encrypted connection (HTTPS/TLS). Uploaded files sit on that server’s disk, readable only by the application.

We are a small operation. We do not claim SOC 2, ISO 27001 or a bank-grade security programme, because we do not have one. What we have instead is a system that holds nothing an attacker could use to touch your money.

Nobody buys it, and we do not sell or rent it. It is shared only with the services that make the product work:

Anthropic — reads your statements to extract transactions. Resend — delivers your sign-in emails, so it sees your email address. Google — only if you choose to sign in with Google. DigitalOcean — hosts the server. Cloudflare — serves the domain.

We would also disclose data if legally compelled. If that ever happens and we are permitted to tell you, we will.

Delete a statement from the Statements screen. The stored file is removed and so is every transaction read from it. Transactions that also appear in another statement you still have are kept, because that other statement still evidences them.

Delete your account by emailing us. Everything goes: profile, declared assets and liabilities, statements, transactions, analysis. Removal from live systems is immediate; encrypted backups roll off within 30 days.

We keep records of payments for as long as tax law requires, and an audit entry that an account was deleted. Neither contains your financial data.

You can ask for a copy of your data, correct it, or have it erased. Write to us and we will action it within 30 days. If you are in the EU or UK, the GDPR rights to access, rectification, erasure, restriction, portability and objection apply, and our lawful basis is performing the contract you signed up for.

If we change something that materially affects your data, we will email you before it takes effect — not silently update this page and change the date.